@rigour-labs/core 5.1.2 → 5.2.0

package/dist/pattern-index/security.d.ts

@@ -21,5 +21,9 @@ export declare class SecurityDetector {
     getSecuritySummary(): Promise<string>;
     private getLockfileHash;
     private getCachedResult;
+    private runBestAvailableAudit;
+    private getAuditCommandCandidates;
+    private extractVulnerabilities;
+    private toSecurityEntry;
     private saveCache;
 }

package/dist/pattern-index/security.js

@@ -27,29 +27,8 @@ export class SecurityDetector {
             if (cached) {
                 return cached;
             }
-            // Run npm audit --json for machine-readable CVE data
-            const { stdout } = await execa('npm', ['audit', '--json'], {
-                cwd: this.rootDir,
-                reject: false // npm audit returns non-zero for found vulnerabilities
-            });
-            const auditData = JSON.parse(stdout);
-            const vulnerabilities = [];
-            if (auditData.vulnerabilities) {
-                for (const [name, vuln] of Object.entries(auditData.vulnerabilities)) {
-                    const v = vuln;
-                    // Dig into the advisory data
-                    const via = v.via && Array.isArray(v.via) ? v.via[0] : null;
-                    vulnerabilities.push({
-                        cveId: via?.name || 'N/A',
-                        packageName: name,
-                        vulnerableRange: v.range,
-                        severity: v.severity,
-                        title: via?.title || `Vulnerability in ${name}`,
-                        url: via?.url || `https://www.npmjs.com/package/${name}/vulnerability`,
-                        currentVersion: v.nodes && v.nodes[0] ? v.version : undefined
-                    });
-                }
-            }
+            const auditData = await this.runBestAvailableAudit();
+            const vulnerabilities = this.extractVulnerabilities(auditData);
             const result = {
                 status: vulnerabilities.length > 0 ? 'VULNERABLE' : 'SECURE',
                 vulnerabilities: vulnerabilities.sort((a, b) => {
@@ -110,6 +89,68 @@ export class SecurityDetector {
         }
         return null;
     }
+    async runBestAvailableAudit() {
+        const candidates = await this.getAuditCommandCandidates();
+        let lastError = null;
+        for (const candidate of candidates) {
+            try {
+                const { stdout, stderr } = await execa(candidate.cmd, candidate.args, {
+                    cwd: this.rootDir,
+                    reject: false // audit tools return non-zero when vulnerabilities are found
+                });
+                const output = stdout || stderr;
+                return JSON.parse(output);
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        throw lastError || new Error('No audit command available');
+    }
+    async getAuditCommandCandidates() {
+        const hasPnpmLock = await fs.access(path.join(this.rootDir, 'pnpm-lock.yaml')).then(() => true).catch(() => false);
+        if (hasPnpmLock) {
+            return [
+                { cmd: 'pnpm', args: ['audit', '--json'] },
+                { cmd: 'npm', args: ['audit', '--json'] }
+            ];
+        }
+        const hasYarnLock = await fs.access(path.join(this.rootDir, 'yarn.lock')).then(() => true).catch(() => false);
+        if (hasYarnLock) {
+            return [
+                { cmd: 'yarn', args: ['npm', 'audit', '--json'] },
+                { cmd: 'npm', args: ['audit', '--json'] }
+            ];
+        }
+        return [{ cmd: 'npm', args: ['audit', '--json'] }];
+    }
+    extractVulnerabilities(auditData) {
+        const vulnerabilities = [];
+        if (!auditData || !auditData.vulnerabilities || typeof auditData.vulnerabilities !== 'object') {
+            return vulnerabilities;
+        }
+        for (const [name, vuln] of Object.entries(auditData.vulnerabilities)) {
+            vulnerabilities.push(this.toSecurityEntry(name, vuln));
+        }
+        return vulnerabilities;
+    }
+    toSecurityEntry(name, vuln) {
+        const viaList = Array.isArray(vuln?.via) ? vuln.via : [];
+        const via = viaList[0];
+        const cveId = via?.name ?? 'N/A';
+        const title = via?.title ?? `Vulnerability in ${name}`;
+        const url = via?.url ?? `https://www.npmjs.com/package/${name}/vulnerability`;
+        const currentVersion = vuln?.nodes?.[0] ? vuln.version : undefined;
+        return {
+            cveId,
+            packageName: name,
+            vulnerableRange: vuln.range,
+            severity: vuln.severity,
+            title,
+            url,
+            currentVersion,
+        };
+    }
     async saveCache(hash, result) {
         try {
             await fs.mkdir(path.dirname(this.cachePath), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "description": "Deterministic quality gate engine for AI-generated code. AST analysis, drift detection, and Fix Packet generation across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -59,11 +59,11 @@
     "@xenova/transformers": "^2.17.2",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "5.1.2",
-    "@rigour-labs/brain-linux-x64": "5.1.2",
-    "@rigour-labs/brain-linux-arm64": "5.1.2",
-    "@rigour-labs/brain-win-x64": "5.1.2",
-    "@rigour-labs/brain-darwin-x64": "5.1.2"
+    "@rigour-labs/brain-darwin-arm64": "5.2.0",
+    "@rigour-labs/brain-linux-x64": "5.2.0",
+    "@rigour-labs/brain-linux-arm64": "5.2.0",
+    "@rigour-labs/brain-darwin-x64": "5.2.0",
+    "@rigour-labs/brain-win-x64": "5.2.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",